CVE-2024-1204
Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure
- State
- Published
- Severity
- 4.3 Medium
- Published
- Apr 15, 2024
- Updated
- Aug 1, 2024
- Reserved
- Feb 2, 2024
Description
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Meta BoxUnknown |
|
References
- https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.